CVE Vulnerability Catalog

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server, potentially exposing sensitive information.

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to and including 1.0.3. Unauthenticated attackers can modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs, potentially redirecting payments to their own Stripe accounts.

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to and including 1.0.2. Unauthenticated attackers can delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the 'clear_api_type' parameter.

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to and including 1.0.3. Unauthenticated attackers can modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. Some digit writes and the terminating NUL write do not check for room, leading to out-of-bounds writes.

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area. An unauthenticated user can submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV. This allows unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to and including 3.3.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into the translation dictionary that execute in an administrator's session.

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to and including 11.8.3 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute if they can trick a user into performing an action such as clicking a link.

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators.

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' Block Parameter in all versions up to and including 4.4.1 due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress is vulnerable to unauthorized modification of data leading to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to and including 4.1.17. An authenticated attacker with Editor-level access or above can update arbitrary options, including the default registration role to administrator.

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input. Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless another plugin or theme containing a POP chain is installed. Exploitation requires the "Allow Multiple Recipients" option to be enabled and the eCard "Custom Message" option to be disabled (the plugin default).

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: populate_via_query_string() unconditionally overrides the form's target object_id without authorization checks, and Form::process() lacks the user_can_edit() check, allowing unauthenticated attackers to overwrite any page's post_content with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode without role validation. The standalone plugins Meta Box Frontend Submission (up to 4.5.6) and Meta Box User Profile (up to 3.11.0) are also affected.

A vulnerability was detected in Gigatech PDV5701 version 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the WebSocket Service component, resulting in missing authentication. The attack can be launched remotely, and the exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the OpenAPI component. Manipulation of the operator argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Manipulation of the address argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, allowing access to files outside the public directory. The handler is off by default, but an application is affected once it names File in route_handlers and sets static_handler to 0.

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name, allowing injection of additional headers and response splitting. The application must derive the header name from request data.